"SOFTWARE\Adobe\Adobe Acrobat" in Source: sample.bin, "SOFTWARE\Adobe\Adobe Acrobat\" in Source: sample.bin, "HKEY_LOCAL_MACHINE\System\Setup\MoSetup\Volatile\SetupDiag" in Source: sample.bin, "SOFTWARE\Google\Chrome\NativeMessagingHosts\com.adobe.acrobat.chrome_webcapture" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: sample.bin, "Unable to open HKLM\SOFTWARE\RegisteredApplications" in Source: sample.bin, "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: sample.bin, "HKEY_CLASSES_ROOT\Software\Adobe\Acrobat\Exe set failed." in Source: sample.bin, "uninstall))\]\]> (?\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}),\sInfo\s+MOUPG\s+SetupHost::Initialize:\sCmdLine\s+=\s\[/(?.+)\s/RollbackSys)\]\]> (?\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}),\s+Info\s+MOUPG\s+CInstallUI::ShowRollbackPage)\]\]> \s+Info\s+SP\s+Antivirus\ssoftware\sinformation:\r\n\s+Name:\s(?[\w\s]+),)\]\]> \s+New\sfilter\sdriver\sName:\s(?\w+),)\]\]> [^\.]{16})\]\]> [^\.]{16})\]\]> [^\.]{16})\]\]> [0-9a-fA-Z" in Source: sample.bin, "HKEY_CLASSES_ROOT\Software\Adobe\Acrobat\Exe set successfully" in Source: sample.bin, "SOFTWARE\Adobe\Adobe ARM\1.0\ARM" in Source: sample.bin, "SOFTWARE\RegisteredApplications" in Source: sample.bin, " Registry data will go to HKEY_LOCAL_MACHINE\SYSTEM\Setup\MoSetup\Volatile\SetupDiag unless otherwise specified." in Source: sample.bin, "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection" in Source: sample.bin, "SOFTWARE\Classes\Applications\AcroRD32.exe\CurVer" in Source: sample.bin, "Software\Adobe\Acrobat Reader\" in Source: sample.bin, "Unable to query HKLM\SOFTWARE\RegisteredApplications" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\" in Source: sample.bin, "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: sample.bin, "Software\Adobe\Acrobat\Exe" in Source: sample.bin, "SOFTWARE\Adobe\Adobe ARM\Legacy\" in Source: sample.bin, "SOFTWARE\Adobe\Acrobat Reader\" in Source: sample.bin, "> failed\sto\sextract\sfile\sfrom\sreference\sextension\]\s(?.+)\s\(Error\s=\s(?[\d]+)\))\]\]> Error\s+SP\s+Operation\sfailed:\sApply\sWIM\sfile\sPathForNewOSFile(?:\s\(compact\))?,\sindex\s[\d]+\sto\s(?.+)\sError:\s(?0x\w{8}))\]\]> (?\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}),\sInfo\s+MOUPG\s+SetupHost::Initialize:\sCmdLine\s+=\s\[/(?.+)\s/RollbackSys)\]\]> (?\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}),\s+Info\s+MOUPG\s+CInstallUI::ShowRollbackPage)\]\]> \s+Info\s+SP\s+Antivirus\ssoftware\sinformation:\r\n\s+Name:\s(?[\w\s]+),)\]\]> \s+New\sfilter\sdriver\sName:\s(?\w+),)\]\]> [^\.]{16})\]\]> [^\.]{16})\]\]> [^\.]{16})\]\]> [0-9a-fA-Z]" in Source: sample.bin, "SOFTWARE\Classes\Applications\Acrobat.exe\CurVer" in Source: sample.bin, "nt.sys file version. Last Phase: %LastPhase% Last Operation: %LastOperation% DriverPath: %DriverPath% Error = %Error%" Args=""> failed\sto\sextract\sfile\sfrom\sreference\sextension\]\s(?.+)\s\(Error\s=\s(?[\d]+)\))\]\]> Error\s+SP\s+Operation\sfailed:\sApply\sWIM\sfile\sPathForNewOSFile(?:\s\(" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Run" in Source: sample.bin, "